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* ~ «^oi switched network communications measurement matrix 
© Method and apparatus for a packet-switched nerwur* 

display. 



© Disclosed is a communications measurement 
matrix display (Figs. 4A, 48) for a ^^^^ 
(15) which rs used to monitor traffic on a pactet 
switched network (Rg. 1). The present uiwtoon 
allows the protocol analyzer user to see. at a glance^ 
a complete and accurate overview of communica- 
tions between more than thirty-one nodes jn a 
packet-switched network, over a user selectabte 
range of measurement-time intervals. The ^rmrtnx ds- 
CSlplay has two modes. One mode (Rg. 4A)^ows^e 
< Source versus the destination nodes of the ne^k 
rCfc as a 32-X-32 two^irnensional X-Y gnd matnx having 
§ thirty one source nodes ordinal* ™ 
"grid axis and thirty one destination nodes ortfnaHy 
^indicated along the other grid axis. The thirty second 
S ordinal position on each axis ™* 
CM other than the first thirty one nodes. A display mark- 
0 er (50. 55) positioned on the 9^ indicates ^ 
Tf nication between the source node and the dest na- 
gjtion node which correspond to the 

/SOURCE. DESTINATION), coordinates of the mark- 
or. m a second mode (Rg. 48). the display shows 



the node connections only: the display is simply t 
32-X-32 two-dimensional X-Y grid having thirty twc 
nodes orrJnalty indicated on each axis without diroc 
tion such as source or destination, indicated. The 
display of the second mode (26B) is essentially the 
display of the first mode (26A) folded along it 
diagonal. The matrix display, in both modes, is par 
ticularty wen suited to the IEEE 802,3 Local Are: 
Network packet-switched network. The matrix c£s 
play is accomplished using a combination of dec* 
cated hardware and real-time software. The hare 
ware consists of a so-called address trap machirv: 
(100) which is programmed with the addresses c 
the nodes of the network. The address trap machirv 
catches the source and destination address of eacr 
information packet (Rg. 2) transmitted on the r*r 
work transmission mecSum without disrupting pack? 
trans mission. The address trap then outputs 
sixteen-bit word containing the node numtxr 
matched by the source and destination addresses <■ 
each frame. A fast execution softwar loop (12 
collects the counts for each of toe nodes and pir 
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Uie results into a 32 X-32 array (120). Higher level 
software (130. 132) accumulates the array values for 
the duration of a user-selected measurement-time- 
interval and quantifies each count based on a user- 
adjustable legend setting. The appropriate marker 
from the user-adjustable legend of traffic volume 
markers is then presented on the grid matrix cfispfay 
(155). 
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METHOD AND A PPARATUS FOR A PACKET-SWITCHED NETWORK COMMUNICATIONS MEASUREMENT 
MATRIX DISPLAY 



BACKGROUND OF THE INVENTION 

A packet- switched network is a <Sgrtal tele- 
communications scheme that provides interconnec- 
tion of a variety of data communications devices. 
Geographically, these devices can be widely sepa- 
rated or quite close. For instance, a wide area 
packet-switched network (WAN) may span me 
world ; a regional area network (RAN) may cover an 
entire state; and a metropofitan area network 
(MAN) may cover a large city. Finally, a local area 
network (LAN) may cover a more BmHed area such 
as a college campus or an office building. Various 
devices such as computers, terminals, printers, and 
so on, can be "plugged into" a network at specific 
network locations known as nodes. Each node on 
the network is assigned a unique address so that 
messages between devices at different nodes can 
be properly transmitted and received over the net- 
work. 

Messages between devices on a packet- 
switched network consist of cfiscrete packets of 
digital information. In order for the network to op- 
erate efficiently, such packets must conform to 
strict network protocol regarding transmission and 
format of the information packet For instance, a 
well-known and commercially accepted LAN stan- 
dard is encompassed by th e Inst itute of Electrical 
and Electronic Engineers (IEEE) standard 802.3- 
The IEEE 802.3 standard features a Carrier Sense 
Multiple Access with ColHsion Detection 
(CSMA/CO) media access system whereby two or 
more nodes, that is communication devices, share 
a common bus transmission medium, such as a 
coaxial cable. To transmit over the LAN, a device 
at a node waits for a quiet period on the bus, frat 
is. no other node is transmitting. The transmits ng 
device then sends its message packet in bet-serial 
form at rates up to 10 Mbrts^sec The 8023 LAN 
message packet is known as a frame* and its 
format is highly standardized. 

Obviousfy, management of a packet-switched 
network is a complicated task. For instance, mod- 
ern 802.3 LAN systems can commonly accom- 
modate numerous nodes and tolerate data traffic 
capacities as high as 15K frames/seconds. Hence, 
monitoring and management of 802-3 LAN data 
traffic is crucial. WAN. RAN and MAN systems 
may pose even larger challenges, but the general 
management problem is weU illustrated by focusing 
on 802.3 LANs. Efficient management of fre 8023 
LAN requires a high-level view of the network as a 
whole, analogous to using aerial views of metropofi- 



tan auto traffic to spot areas of congestion. A high- 
level view of the network would allow immediate 
determination of which nodes generate or receive 
the most traffic, which nodes are busiest at any 
s given time, what device Is at any given node, 
unusual or unexpected network activity, and so on. 
Such an "aerial* view is useful for quick detection 
and diagnosis of network activity. 

Currently, some LAN devices provide node 
to statistics which give tabular results summarizing 
activity at the nodes where the devices are located. 
Such devices may identify overloaded nodes but 
they cannot give inter-node information. Moreover, 
the data provided by such devices may be unintel- 
15 Ggible to individuals without familiarity or, perhaps, 
expertise with the device. Inter-node information 
can be provided by protocol analyzers which sam- 
ple LAN traffic overall to provide tabular statistics 
regarding the volume of node transmissions and 
20 receptions. However, such analyzers may fail to 
provide node-connection information and their re- 
sults may be incomplete because important data 
may be missed in the sampfng process. These 
devices may also require special expertise. Finally, 
25 node-connection information has been provided by 
a path detection software package implemented by 
Xerox corporation for experimental network morv 
tioring, as described in "Measured Performance of 
an Ethernet Local Network*. Communications Of 
30 The ACM . Dec 1980. Vol 23. #12- This package 
shows whether or not a communication occurred 
between nodes during the rneasurment intervaL 
However, it fails to indicate the volume of traffic for 
a given node connection. Also, ft too is based on a 
35 sampling technique so that some data may be 
missed in the sampling process. 



40 



SUMMARY OF THE INVENTION 

The present invention advances the art of 
packet-switched network rnonrloring. maintenance 
and management with a communications measure- 
ment matrix display for a protocol anaryzer. The 
45 display allows the protocol anaryzer user to see. at 
a glance, a high-level "aerial" view of communica- 
tions between virtually any number of nodes on a 
packet-switched network. The preferred embodi- 
ment of the present invention is particularly wefl 
so suited for 8023 LAN systems for reasons of com- 
mercial acceptabiBty, but its saEent features are 
designed for packet-switched networks generally, 
to one application of the present invention, known 
as me SOURCE vs. DESTINATION communica- 
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Hons matrix, the Ngh-tevel display is a 32-X-32 
two-dimensional X-Y grid matrix having thirty-one 
"source" nodes ordinally indicated along one grid 
axis and thirty-one "destination" nodes ordinally 
indicated along the other grid axis. The thirty- 
second ordinal position on each axis designates 
any node other than the first thirty-one nodes. A 
display marker positioned on the grid indicates 
communication between the source node and the 
destination node which correspond to the (X.Y). 
that is. the (SOURCE.DEST1NATION). coordinates 

oi the marker. 

In a second application of the present inven- 
tion, known as the NODE CONNECTIONS TOTALS 
communications matrix, the display is simply a 32- 
X-32 two-danensional X-Y grid matrix having thirty- 
two nodes ordinally indfcated on each axis. The 
NOOE CONNECTIONS TOTALS communications 
matrix is essentially the SOURCE vs. DESTINA- 
TION matrix folded along its diagonal such that the 
display markers indicate simply the magnitude of 
traffic between a given node and every other node, 
without indicating direction of traffic as between a 
source and a destination. 

In both applications, a legend set of easily 
distinguishable display markers is used to distin- 
guish different volumes of traffic between nodes. 
Moreover, the legend is adjustable so that the 
traffic volume associated with each marker can be 
set by the user. The display Is also available m 
cokx. further enhancing legend marker distin- 

gutshabiTity. 

The present invention can also display the re- 
sults of continuous network monitoring over a user- 
setectable range of rneasurement-time-iritervals 
ranging from one second up to four hours. A 
-running average" display for as many as ten 
measurement-time-intervals is also available such 
that the network may be continuously disptey-mon- 
Hored for as along as forty hours. 

Finally, unlike statistical sampling systems 
which may miss data in the sampling process, the 
present invention is based on dedicated hardware 
which detects and "reads" all network traffic with- 
out interfering with such traffic Although the 
present invention could be sampling-based, a dedi- 
cated hardware implementation was chosen so that 
the user can be sure that the display completely 
reflects all network activity, some of which could 
otherwise be missed in statistical sampling pro- 

ceSSeS. 

The present invention measures network com- 
munications via a combination of dedicated hard- 
ware and reaWime software. The hardware consists 
of a so-caBed address-trap machine which is pro- 
grammed with the addresses of the nodes on the 
network. The address-trap machine catches me 
source and destination address of each information 



packet transmitted on the network transmission 
medium without disrupting packet traftsrrussicn. 
The address-trap machine then outputs a sixteen- 
th word containing the node numbers matched by 
s the source and destination addresses of each pack- 
et A fast execution software loop collects the 
counts for each of the nodes and puts the results 
into a 32-X-32 array. Higher level software accu- 
mulates the array values for the Action of the 
io user-selected measurement^ime-«terva] and quan- 
tifies each count based on me user-selected leg- 
end setting. The appropriate marker is then pre- 
sented on the grid matrix olsptay. 

Hence, the present irtvertfon allows the pro- 
is toco! anahyzer user to see, at a glance, a complete 
and accurate overview of communicatee between 
more man thirty-one nodes on a packet-switched 
network, over a user-selectable range of 
measurement-tirr^-intervais. The display simutta- 
20 neousty identifies the most heavily loaded and 
heavily loading nodes and makes readily visible 
unusual or unexpected network activity. The dis- 
play provides a unique "aeriaT view of the network 
aBowing for quick understantfng and diagnosis of 
25 activity anywhere on the network. 

BRIEF DESCRIPTION OF THE DRAWINGS 

30 Figure 1 shows a scnemafic overview of a 

Local Area Packet-Switched Network (LAN). 

Figure 2 shows a sdhematic block diagram 
of an 802-3 LAN packet known as a frame. 

Figure 3 shows a general overview of a 
35 protocol analyser interfacing w»i a LAN transmis- 
sion medium bus. 

Rgure 4A shows a sample SOURCE vs. 
DESTINATION communicafions matrix display con- 
stituting one application of me present invention. 
<o Rgure 48 shows a sample NODE CONNEC- 

TIONS TOTALS cx^mmunicatjons matrix display 
constituting a second appficafion of the present 
kivention. 

Rgure 5 shows a schematic block diagram 

45 of the present invention. 

Rgure 6 shows a schemafic diagram of AD- 
DRESS TRAP 100 of Figure 5. 

Rgure 7 shows the relafenship between a 
FIFO 110 word and UPDATE MATRIX 120 of Fig- 
so ure 5. 

Rgure 8 shows a funcfionai diagram of 
. - TIGHT LOOP 122 of Figure 5. 

Rgure 9 shows me relationship between the 
1024 counter-elements of UPDATE MATRIX 120 
and the 1024 grid positions of matrix display 26A- 

(B) of Figure 4A(B). 

Rgure 10 shows a funcfionai diagram of 
TIMER-CLOCK LOOP 130 of Figure 5. 
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. Figure 11 shows a functional diagram of 
MEASUREMENT LOOP 132 of Figure 5. 

Figure 12 shows a functional diagram of 
DISPLAY LOOP 155 of Figure 5. 



DESCRIPTION OF THE PREFERRED EMBODI- 
MENT OF THE PRESENT INVENTION 

Figure 1 shows a schematic overview of an 
802.3 local area network (LAN) having thirty-two 
nodes, which is shown to illustrate the general 
nature of a packet-switched network. At each node, 
a device can be connected to the network. Such a 
device may be a terminal, a printer, a computer, 
and so on. The nodes are interconnected to each 
other by transmission bus 5 which is typically a 
coaxial cable. Devices at different nodes interface 
with bus 5 via a standardized transmission medium 
access unit (MAU) and attachment unit interface 
cable (AUI). Devices then communicate with each 
other through transmission and reception of <fis- 
crete packets of digital information on bos 5. Each 
discrete information packet is known as a LAN 
frame. Device 7 at node-two interfaces with LAN 
bus 5 via AUI 9 and MAU 10. Also shown is 
protocol analyser 15. such as would be used with 
the present invention. Protocol analyser 15 
"eavesdrops" on the LAN at node-thirty-one via 
AUI 1 7 and MAU 20. Protocol analyser 1 5 is used 
to monitor, without interrupting, frame traffic on me 
LAN. 

Figure 2 shows a schematic overview of an 
802.3 LAN frame, which is shown to illustrate the 
general nature of a packet-switched network in- 
formation packet. The 802.3 LAN frame is a stan- 
dardized discrete packet of cfigital information. De- 
vices on a 802-3 LAN communicate with each other 
through the transmission and reception of such 
frames. Examining the frame from head to tail, the 
802.3 LAN frame consists of an 8-byte preamble: a 
6-byte destination address which uniquely identifies 
the node to which the frame is being sent a 6-byte 
source address which uniquely identifies the node 
from which the frame originated; a 2-byte data-type 
field which irxficates the type of data which the 
frame contains; a data field that may be from 46 to 
1 500 bytes long; followed by a 4-byte frame check 

sequence- 
Figure 3 shows a general overview of protocol 
analyser 15 of Rgure 2. interfacing with LAN bus 5 
via AUI 17 and MAU 20. The results of monitoring 
and analysis of frame traffic on LAN bus 5 are 
ci splayed on display screen 25. 

Figure 4A is a sample of one application of the 
present invention known as the SOURCE vs. DES- 
TINATION communications matrix display, tr*Scat- 
ed by reference numeral 26A. As can be seen. 



display 26A consists of a 32-X-32 two-dtfnensional 
grid matrix having thirty-one source nodes ordinary 
indicated along fte horizontal axis and thirty-one 
destination nodes ordi natty indicated along the ver- 
s tical axis. The thirty-second ordinal position on 
each axis designates any node other than the first 
thirty-one nodes. A display marker positioned on 
the grid indicates network comrmjnkation between 
the source node and the destination node which 
to correspond to the (SOURCE. DESTINATION) co- 
ordinates of the marker. In Rgure 4A. two such 
markers are indicated by reference numerals 50 
and 55. To the right of the matrix is traffic volume 
legend 27 having different, easily <£stinguishabte. 
75 display markers associated with Afferent volumes 
of network communication traffic. Legend 27 is 
adjustable so that the user may select the traffic 
volume associated with each marker. Such network 
traffic volume is measured in units of 
20 frames/(measureri^nt-time^tervaO. The 
measuremem-time-interval is user-selectable over a 
range of one second to four hours. The 
measurement-time-interval is displayed on the 
screen as the sample time, as shown in Figure 4A. 
25 In Figure 4A the sample time is one second so that 
network traffic volume is measured in units of 
frames/second. Hence, display marker 50 indicates 
that between twenty and fifty frames'second are 
being sent from node-four to node-sbcteen white 
30 display marker 55 indicates that between five and 
ten frames/second are being sent from rtode-twerve 
to node-seven. The remaining display markers in 
Figure 4A represent similar information. Another 
feature of the present invention is the average time. 
35 The average time is an integral multiple, from one 
to ten. of the sample time. The average time in 
Figure 4A is shown as ten sample times. The 
average time defines how often the display is up- 
dated. Hence, in Figure 4A the cBsptay 26A would 
*o be updated once a second for ten seconds, in 
•running average* fashion. The runnirig average 
works as foflows: suppose the user selects a 
sample-time, that is. a measurement- time-interval . 
of one second and an average time of ten. After 
<«$ one second foe frame counts for each matrix grid 
position are each divided by the sample-time and 
the appropriate markers from legend 27 are dis- 
played at the appropriate grid positions. After two 
seconds, the frame counts of the first sample-time 
so interval are added to the corresponding frame 
counts of the second sample-time interval, the re- 
sultant sum is divided by two seconds and the 
appropriate legend 27 markers are displayed in the 
appropriate grid positions. After three seconds, the 
55 frame counts tor the first two sample-time intervals 
are added to the corresponding frame counts of the 
third sample-time interval, the sum of all three 
'sample-time intervals are divided by three sec- 
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onds. and the appropriate legend 27 markers are 
displayed in the appropriate grid positions. This 
process continues until the counts of ten sample- 
time intervals are added, the resultant sum divided 
by ten sample-times, that Is. ten seconds, and the 
legend 27 markers displayed. Moreover, the run- 
ning average Is continuous. That is. the running 
average window moves forward in time so that the 
most recent sample-time interval is always includ- 
ed. For instance, suppose that the sarnp»e-time Is 
one second and the average time is five. After five 
seconds, the frame counts of sample-time intervals 
#1 through #5 would be added and their sum 
divided by five seconds and the legend 27 markers 
displayed. After six seconds, the frame counts from 
sample-time intervals #2 through #6 would be ad- 
ded, etc. After seven seconds, the frame courts 
from sample-time intervals #3 through #7 would be 
added, etc. The end result of the running average 
feature is a continuous display that can change as 
network traffic volume changes. Finally, the high- 
level "aerial" perspective of the network provided 
by the present invention is also evident from Figure 
4A. For instance, a mere glance is required to 
realize that node-four is a busy source node white 
node-eight is a busy destination node. K a network 
manager suspected a faulty transmitter somewhere 
on the network, such -aerial' information helps to 
quickly diagnose its location, particularly if node- 
four is busier than expected, for example- 

Figure 48 is a sample of a second appBcaton 
of the present invention known as the NODE CON- 
NECTIONS TOTALS communications matrix dis- 
play, indicated by reference numeral 268. NODE 
CONNECTIONS TOTALS display 268 is essentially 
SOURCE vs. DESTINATION display 26A folded 
along its diagonal such that the display markers 
indicate simply the magnitude of traffic between a 
given node and every other node, without abdicat- 
ing the direction of traffic, such as between a 
source and a destination. The folding of the 
SOURCE vs. DESTINATION display to produce the 
NODE CONNECTIONS TOTALS display is more 
fully discussed in connection with Figure 9. 

Figure 5 shows a schematic overview of fhe 
hardware used to implement fhe displays of Figure 
4A and 48. As frame traffic travels between LAN 
nodes on LAN bus S. fhe destination and source 
address of each frame is captured by ADDRESS- 
TRAP 100 via MAU 20 and AUI 17. (Such capture 
does not interfere with normal frame traffic on bus 
5 ) The ADDRESS-TRAP 100 is programmed with 
the addresses of the thirty-one nodes on the LAN. 
For each frame. ADDRESS-TRAP 100 outputs a 
sixteen-bit word on bus 105. The least significant 
five bits of each sixteen^ word represent anum- 
ber between zero and thirty-one which corresponds 
to the node number of the source address. The 



next most significant fiv bits of each sjxteen-brt 
word represent a number between »ro and thirty- 
one which corresponds to the node number of the 
destination address. The remaining six bits are set 
s to zero. These zero bits prove to be useful for bit 
shifting purposes as xptained below. Hence, for 
each tram travefing on LAN bus 5. ADDRESS- 
TRAP 100 outputs a sixteen-bit word having the 
configuration: 000000DDDDOSSSSS. where 0 re- 
to presents the zero field. D represents the destina- 
tion address field and S represents the source 
address field. The sixteen-bit word outputs of 
ADDRESS-TRAP 100 are temporarily stored m 
FtfsHn-Rrst-Out (FIFO) buffer 110. (ADDRESS- 
is TRAP 100 and FIFO 110. together with AUI 17 and 
MAU 20. are known in the prior art as an LAN 
receiver board and shallow trap machine which are 
included in me Hewlett-Packard 4971 A Protocol 
Analyser and described in the 4971A Hardware 
» Support Manual, part # 04971 -90005. and available 
to the pubBc as such.) In the preferred embodiment 
of the present invention. FIFO 110 has a capacity 
to hold 512 sixteen-bit words. When FIFO 110 «s 
half fufl. it generates INTERRUPT 125. at which 
as time the contents of FIFO 110 are transferred vsa 
bus 115 to UPDATE MATRIX 120. UPDATE MA- 
TRIX 120 represents a real-time digital version of 
fhe matrix ofcptay. UPDATE MATRIX 120 contains 
32-X-32 = 1024 elements where each element is a 
M sixteen-bit word. Each element of UPDATE MA- 
- TRTX 120 is essentially a sixteen-bit counter cor- 
responding to one of the 32-X-32 = 1024 grid 
positions of fhe matrix display 26A of figure 4A. 
UPDATE MATRIX 120 is implemented with 1024 
3S consecutive sixteen-bit words of memory. A given 
counter-element in UPDATE MATRIX 120 is incre- 
mented when a word from FIFO 110 is received 
containing fhe destination and source fields which 
correspond to that element in fhe matrix. The cor- 
40 respondence between words in FIFO 110 and 
counter-elements in UPDATE MATROX 120 is gov- 
erned by TIGHT LOOP 122. Each second. TIMER- 
CLOCK LOOP 130 triggers UPDATE MATRIX 120 
and SNAP-SHOT BUFFER 140 and the contents of 
4S UPDATE MATRIX 120 are transferred to SNAP- 
SHOT BUFFER 140 via bus 125 and UPDATE 
MATRIX 120 is cleared. SNAP-SHOT BUFFER 140 
is appropriately named because a essentially con- 
tains a second-by-second -snap-shot' copy of the 
so contents of UPDATE MATRIX 120. SNAP-SHOT 
BUFFER 140 is also implemented with 1024 con- 
secutive sixteen-bit words in memory. Note that 
interval of TIMER-CLOCK LOOP 130 is equal to 
fee smallest measurerrtert-fime-interval. that is. one 
55 second. This is so that UPDATE MATRIX 120 is 
cleared and ready for new data at least as often as 
fhe time-tenglh of the shortest measurement-time- 
interval. MEASUREMENT LOOP 132 controls fre 
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transfer and accummulation of successive snap- 
shots from SNAP-SHOT BUFFER 140 to ACCUM- 
MULATION MATRIX 150 for the duration of the 
user-selected measurement-time-interval. like UP* 
DATE MATRIX 120, ACCUMULATION MATRIX 
150 also has 32-X-32 * 1024 counter-elements but 
each counter-element of ACCUMMULATION MA- 
TRIX 150 is a thirty-two-bit word. ACCUMMULA- 
TION MATRIX 150 requires larger sized counter- 
elements because it records the accumulated 
frame counts of each element of UPDATE MATRIX 
120 over the entire user-defined measurement- 
time-interval, which may be as long as four hours. 
Each of the 32-X-32 = 1024 counter-elements of 
ACCUMMULATION MATRIX 150 corresponds to 
one of the 32-X-32 » 1024 matrix grid positions of 
matrix display 26A of Figure 4A. in a memory 
mapping fashion. Each counter-element of ACCU- 
MULATION MATRIX 150, therefore, contains the 
frame count value for a corresponding grid position 
of matrix display 26A for the given user-selected 
measurement-time-interval. ACCUMMULATION 
MATRIX 150 is implemented with 1024 consecutive 
thirty-two-bit words in memory. DISPLAY LOOP 
155 governs the interaction of ACCUMMULATION 
MATRIX 150 and DISPLAY 25. DISPLAY LOOP 
155 reads the count values of each counter ele- 
ment of ACCUMMULATION MATRIX 150 for the 
user-selected measurement-time-interval and then 
positions the appropriate legend 27 display mark- 
ers at the appropriate positions on DISPLAY 25. 

Rgure 6 shows a schematic diagram of AD- 
DRESS TRAP 100 of Figure 5. Network packet 
traffic is "captured" by ADDRESS TRAP 100. with- 
out intederring with such traffic via MAU 20 and 
AUI 17. Network interface board 200 processes the 
frames. In the preferred embodiment of the present 
invention, such processing is performed with the 
Intel Corporation 82586 LAN coprocessor which is 
specifically designed for the 802.3 LAN. among 
other things. LAN frames are input into network 
interface 200 in serial format and converted to 
parallel digital data as output Such data is output 
over byte bus 205. In addition network interface 
200 issues control signals via control Bne 210. In 
the preferred embodiment of the present invention, 
the destination and source address fields of each 
LAN frame are transmitted, one byte at a time, over 
byte bus 205 to the eight data inputs of state 
machine 225. In the preferred embodiment of the 
present invention, state machine 225 has sixteen 
inputs, indicated by reference numeral 220. Inputs 
#3 through #10 are data inputs which receive the 
address bytes transmitted by network interface 200 
over byte bus 205. In response to control signals 
from network interface 200 via control «ne 210. 
counter 215 counts the six bytes of the destination 
field of a given LAN frame and then resets and 



counts the six bytes of the source field of that 
frame. Inputs #0 through #2 of inputs 200 of state 
machine 225 receive the counts of counter 215. 
The counts of counter 215 Worm state machine 
s 225 when the complete destination and source 
fields of each frame have been received so that 
state machine 225 ■knows" whether rt just received 
a destination address or a source address. State 
machine 225 is a thirty-two state Moore-type finite 
io state machine. The output of such a state machine 
depends only on Its present state. In the preferred 
embodiment of the present invention, state ma- 
chine 225 is implemented with random access 
memory so that its states am programmable. Es- 
is sentiaJty. the thirty-two states of state machine 225 
are the thirty-two possible network loca&ons of dis- 
play 26A(B) of Figure 4A(B). State machine 225 wit! 
assume one of thirty-two possible states for each 
source or destination address field of an LAN 
20 frame that it receives as input State machine 225 
converts each six-byte address it receives, whether 
it is a source address or a destination address, into 
a five-bit number between 2ero and thirty-one. 
which number win be identical to its present state. 
25 This present state information is output as a five-bit 
number over output fnes 230. The five-bit present 
state number matches the node number of a given 
frame's source or destination address field. The 
five-bit present state number is latched into five-bit 
30 latch 235 in response to 'control signals from net- 
work interface 200 to state machine 225, Network 
interface 200 control signals also trigger dock 232 
which triggers frve-bit latch 235 to output its five-bit 
present state number over output lines 240. The 
35 same present state number is also fed back to 
inputs #11 through #15 of state machine 225 via 
feedback lines 24a Thus, given its present state as 
feedback input state machine 225 wffl transition to 
a programmed next state upon receiving the six- 
40 byte source or destination field of the next frame 
trapped. 

Additional control signals from network interface 
200 latch the five-bit present state number from 
five-bit latch 235 into either eight-bit latch 255 or 

45 eight-bit latch 257 via output fines 240, The most 
significant three bits of both eight-bit latch 255 and 
eight-bit latch 257 are tied to ground so they al- 
ways contain zeroes. The remaining five bits of 
each eight-bit latch will contain a frve-bH present 

so state number from five-bit latch 235. Control sig- 
nals from network interface 200 send the five-bit 
present state numbers corresponding to source 
addresses into eight-bit tech 257 while fre present 
state numbers corresponding to destination ad- 

55 dresses are sent to eight-bit latch 255. Both eight- 
bit latches are then triggered by interface network 
200 control signals such that they produce a single 
sixteen bit word which is written to RFO 110 via 
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bus 105. Each such sixteen-bit word corresponds 
to 8 single LAN frame and has source node in- 
formation In its least slgnHcant five bits, desfcnatoon 
node Information in its next most significant five 
bits and zeroes In the remaining six bits. 

Figure 7 shows the correspondence between a 
FIFO 110 word and the elements of UPDATE MA- 
TRIX 120. In the preferred embodiment of the 
present invention, each word of FIFO 110. such as 
word 300. is associated with a single LAN frame. 
Word 300 is representative of FIFO 11 0 ^worcte. 
which are received as output from ADDRESS- 
TRAP 100 of Figure 5. Word 300 is a sixteen-brt 
word. The least significant five bits of word 300 
constitute a source address field which holdsa 
number, zero through thirty-one. since five bits 
allow for 2* " 32 possible combinations, which 
number represents the source node of a given 
frame. A zero indicates that none of the thirty-one 
nodes was matched. The next most significant five 
bits of word 300 constitute a destination address 
field which holds a number, zero through thirty-one 
representing the destination node of that frame. 
Again, a zero indicates that none of the tr*rty-one 
nodes was matched. The remaining most signifi- 
cant six bits are always zero. Hence. least 
significant ten bits of word 300 account for 2M<-2* 
_ 2 t» « 1024 possible source-X-destination node 
combinations. Each such combination is associated 
with one of the 32-X-32 * 1024 grid pos***** 
display 26A of Figure 4A. For each such , gnd 
position, there Is a counter element in UPDATE 
MATRIX 120. UPDATE MATRIX 120 therefore has. 
1024 counter elements, each of which is a sxteen- 
bit word. Hence, the least significant ten bits of 
each FIFO 110 word, such as word 300. serveasa 
convenient index to the proper location in UPDATE 
MATRIX 120 of the counter element which cor- 
responds to that word's particular source-X-desbna- 
tion combination. Hence, given the starting address 
in memory of 1024 consectutive words, that is. 
UPDATE MATRIX 120. the least significant ten bits 
of a FIFO 110 word, such as word 300. will serve 
as an offset from that starling address of the proper 
counter-cement m UPDATE MATRIX 1»- E*h 
time a counter element is accessed by a FIFO lio 
word, the element is incremented, as explained 

Rqure 8 is a functional diagram of TIGHT 
LOOP 122 of Figure 5. TIGHT LOOP J22 fi rst 
reads a single word from FIFO 110. ltthen shafts 
that word one bit to the left Usft-sh.fbrigsrnph/ 
doubles the number represented by the FIFO word. 
This doubling is necessary in the preferred em- 
bodiment of the present invention as explained 
below. The shifted resuft is then added to the 
starting address of UPOATE MATRIX 120. In the 
preferred embodiment of the present invention, ad- 
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dressing of UPDATE MATRIX 1» is polbrmed 
with a rrucTCJorocessor which addresses 
bered bytes in memory. Hence, sfmpry lefcshrfting 
th FIFO 110 word one bit provides an even num- 
ber which still preserves the proper ojfse* tothe 
starting address in' memory f UPDATE MATRIX 
120. This offset is the location in UPDATE MATRIX 
120 of the counter-element corresponding to the 
oiven WO 110 word. The counter-element at that 
location is then incremented. TIGHT LOOP 122 
repeats until FIFO 110 is empty. 

Figure g shows the relationship between the 
I024^ourrter-etements of UPDATE MATRIX 120 
and the 32-X-32 = 1024 grid positions of matrix 
display 26A(B) of Figure 4A(B). In the preferred 
embodiment of the present invention, display 25 is 
implemented with a raster display and the rxxel 
density of display 26A(B) is 256 pixels wide by 244 
pixel high. Since display 26A(B) has 32-X-32 = 
1024 grid positions, such as grid position #32 in 
the lower-fight-hand comer, each grid position 6 
256/32 = 8 pixels wide and 244/32 * 7 pixels 
high. That is. each grid position consists of a 7-X-8 
= 56 pixel rectangle. Each such pixel rectangle 
can accommodate a single legend 27 marker. This 
relatively large number of pixels accommodates 
the range of legend 27 markers, from the smallest 
marker to the largest marker. The 1024 counter- 
elements of UPOATE MATRIX 120 are essentially 
1024 consecutive sixteen-bft words in memory. The 
elements are consecutively labelled at the right of 
UPDATE MATRIX 120 in Figure 9. Although nu- 
merous memory mapping schemes are possible, 
the scheme employed in the preferred ernbodiment 
of the present "invention is as follows. The element 
#0 of UPDATE MATRIX 120 is mapped onto the 
upper-right-hand most grid position of display 26A- 
(B). Element #1 fe mapped onto the upper4eft- 
hand-most grid position. Bements #2 through #31 
then correspond to the remaining thirty grid posi- 
tions in the top row from left to right Element #32 
of UPDATE MATRIX 120 is mapped onto the the 
lower-right-hand-most grid position of display 26A- 
(B) Element #33 is mapped onto the tower-teft- 
hand-most grid position. Elements #34 through #63 
then correspond to the remaining thirty grid posi- 
tions in the bottom row from left to right The 
remaining thirty rows of grid positions are similarly 
mapped, working vertically from the bottom row. As 
an aid to understanding, the numbers of certain 
elements in UPDATE MATRIX 120 have been writ- 
ten into their corresponding grid positions in dis- 
play 26A(B) in a manner which illustrates the map- 
ping scheme employed. In producing the NODE 
CONNECTIONS TOTALS display 268 . such as « 
Figure 48. the "folding over" of SOURCE vs. DES- 
TINATION display 26A is accomplished as follows: 
each element in memory is added to its mirror 
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image, the resultant sum is divided by the 
measurement-time-interval, that is, the sample- 
time, and the result displayed. Hence, the NOOE 
CONNECTIONS TOTALS display is produced In 
the same way as the SOURCE vs. DESTINATION 
display except that each element is first added to 
its mirror image prior to division by the 
measurement-time-interval. The mirror image c* a 
given element is another element whose destina- 
tion node value matches the given elements 
source node value and whose source node value 
matches the given element's destination node val- 
ue. For instance, the 1024 elements of UPDATE 
MATRIX 1 20 can be addressed with ten-bit offsets. 
The least significant five bits define the source 
node value and the next five bits define the des- 
tination node value for that element For example, 
the mirror image of the element with offset address 
1000101110 is the element with offset address 
0111010001. The result of mirror imaging is that 
the portion above the diagonal in Figure 268 of 
Figure 48 is never accessed. 

Figure 10 is a functional diagram of TIMER- 
CLOCK LOOP 130 of Figure 5. The first function 
TIMER-CLOCK LOOP 130 performs is to cfisaWe 
interrupt 125 of FIFO 110. TIGHT LOOP 122 is 
then invoked to ensure that FIFO 110 is empty. 
TIMER-CLOCK LOOP 130 then reads the first ele- 
ment of UPDATE MATRIX 120. That element is 
then written into the first element of SNAP-SHOT 
BUFFER 140. Then the next element of UPDATE 
MATRIX 110 is read and written to the next ele- 
ment of SNAP-SHOT BUFFER 140. This routine 
repeats until all of UPDATE MATRIX 120 is copied 
into SNAP-SHOT BUFFER 140. UPDATE MATRTX 
120 is then cleared. Interrupt 125 is then enabled. 
It is necessary to first disable interrupt 12S so that 
no new FIFO 110 words will be written to UPDATE 
MATRIX 120 while it is being copied into SNAP- 
SHOT BUFFER 140. After interrupt 125 is enabled, 
a semaphore bit is set in status word of SNAP- 
SHOT BUFFER 140. Setting the semaphore bit 
indicates that SNAP-SHOT BUFFER 140 is stable, 
that is. that it contains the most recent copy of 
UPDATE MATRIX 120. and that the copy can be 
safely read out of SNAP-SHOT BUFFER 140. 

Figure 11 is functional diagram of MEASURE- 
MENT LOOP 132 of Figure 5. MEASUREMENT 
LOOP 132 first tests for the setting of the sema- 
phore brt in the status word of SNAP-SHOT BUFF* 
ER 140. indicating that SNAP-SHOT BUFFER 140 
can be safety read. Once the semaphore is set, 
MEASUREMENT LOOP 132 adds the contents of 
SNAP-SHOT BUFFER 140 to ACCUMMULATION 
MATRIX 150. This adding accummulates Ihe frame 
count values of each lament of UPDATE MATRIX 
120 in ACCUMULATION MATRIX 150. (RecaB that 
ACCUMMULATION MATRIX 150 has tf» same 



number of elements as UPDATE MATRTX 120 but 
each element is twice as targe so that a higher 
count value is possible for each element) MEA- 
SUREMENT LOOP 132 then clears the stability 
s semaphore in SNAP-SHOT BUFFER 140. MEA- 
SUREMENT LOOP 132 then tests for the end of 
the user-selected measurement-time-ritervaJ. The 
measurement-time-Hriterval, that is, the sample- 
time, is the interval of time during which frame 
to counts wiH be accunrvnutated. If the measurement- 
time-interval, that is. the sample-time. Is not over, 
the contents of SNAP-SHOT BUFFER 140 are 
again added to ACCUMMULATION MATRIX 150. 
At the end of the measuremenMime-irrtervaJ, that 
fs is. the sample-time, the rJsplay is updated and 
ACCUMMULATION MATRTX 150 is cleared. If time 
averaging is being employed, the contents erf the 
ACCUMMULATION MATRTX 150 are saved in 
memory prior to clearing. This saving is required to 
20 accummulate previous sample-time c£ splays for the 
duration of the averaging time. When averaging, 
each previous sample-fime copy of ACCUMMULA- 
TION MATRIX 150 is copied into a separate chunk 
ol memory. Hence, i. for instance, the average 
25 time is ten, then ten separate copies of ACCUM- 
MULATION MATRIX 150 are made, one for each 
sample-time intervaL These copies are averaged in 
running average fashion as discussed in connection 
with Figure 4A. 
30 Figure 12 is a func&onai tfagram of DISPLAY 

LOOP 155 of Figure 5. At me end of the user- 
selected measurement-time-mtervaL DISPLAY 
LOOP 155 reads the first element of ACCUM- 
MULATION MATRIX 150. The elements of AC- 
35 CUMMULATJON MATRTX 150 hoU simple count 
values, that is, numbers. The count values repre- 
sent the number of times that a frame with a given 
source-X-destination combination has been 
trapped. This number is then divided by the user- 
40 selected measurement-fime-interval to provide a 
frBmes-/(measurement-*me-irrtervar) ratio. This ratio 
is then compared to the user-defined cfcplay-mark- 
er values, as shown in legend 27 of Figures 4A and 
4B. The ratio is used to determine which display- 
45 marker is required. A check is then made to see rf 
a new marker is required. This check is made to 
avoid unnecessary invocation of display routines, ff 
a new display-marker is required, then it is posi- 
tioned on display screen 25. Screen position is a 
so function of element number as explained in con- 
nection with Figure 9 showing the relationship be- 
tween UPDATE MATRTX 120 and the SOURCE vs. 
DESTINATION display 26A. The 1024 laments of 
ACCUMMULATION MATRIX 150 correspond to the 
ss 32-X-32 « 1024 possAAe grid positions of display 
26A of figure 9 in the same way. The only dif- 
ference is that each element of ACCUMMULATION 
MATRIX 150 is a Ihirty-two-brt word while each 
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element of UPDATE MATRIX 120 is t sbcteen-Wt 
word. The folding over of the SOURCE vs. DES- 
TINATION display to produce the NODE CONNEC- 
TIONS TOTALS display is also cfiscussed in con- 
nection with Figure 9. Mirror imaging of the ele- 
ments of ACCUMMULATtON MATRIX 150 works « 
the same manner as discussed in connection with 
the mirror imaging of UPDATE MATRIX 120 * 
connection with Figure 9. 



Claims 

1. a traffic measurement apparatus (Fig. 5) for 
a packet-switched network (Fig. 1). said packet- 
switched network having a plurality of nodes, said 
nodes hosting devices (7. 15). wherein said devices 
communicate with each other via said network by 
means of transmission and reception of packets of 
information (Fig. 2). said packets having source 
node fields and destination node fields, said 
mesurement apparatus comprising: 

trap means (100) coupled to said switched 
packet network for trapping packets transmitted on 

said network; 

measurement means (110. 122, 125. 130, 132. 
140. 150) coupled to said trap means and operative 
to produce network traffic measurement informa- 
tion; and 

display means (25. 155) coupled to said 
measurement means to present at least a portion 
of said measurement information, wherein sad 
measurement information includes source data re- 
garding the source on the network of network traf- 
fic destination data regarding the destination on 
the network of network traffic and volume data 
regarding the magnitude of said network traffic. 

2. A measurement apparatus as recited m 
ciaim 1 wherein said display means (25. 155) 
graphically presents said measurement information. 

3. A measurement apparatus as recited in 
ciaim 2 wherein said display means includes visual 
display means (25) for graphically presenting said 
measurement information. 

4. A measurement apparatus as recited m 
claim 3 wherein said visual display means is con- 
figured to display a scatter graph (26 A, 26B) de- 
rived from said source data, said destination data 

and said volume data. 

5. A measurement apparatus as recited in 
claim 4 wherein said scatter graph (26A) includes a 
source axis having a plurality of source indicia and 
a destination axis having a plurality of destination 
indicia and wherein traffic activity on said network 
is indicated by communication indicia (27). 

6. A measurement apparatus as in claim 5 
wherein said communication indicia (27) have vi- 
sual characteristics (50. 55) which vary regularly 



with the volume of traffic on said network in a 
manner prescribed by the user of sakj measure- 

merit apparatus. . 
7. A measurement apparatus as recited « 
s claim 4 wherein said scatter graph (26B) has a first 
node axis having a plurality of incScia and a second 
node axis having a pluraRty of incScta . and wherein 
activity on said network is kxficated on sakj 
scatter-graph by communication indicia (27). 
,o 8. A measurement apparatus as recited in 
claim 7 wherein said communicatiwi indicia has 
visual characteristics which vary regularly with the 
volume of traffic on said network in a manner 
prescribed by the user of said measurement ap- 

rs paratus- 

9. A network measurement apparatus (Rg. 5) 
for a packet-switched network (Rg. 1). sakj packet- 
switched network having a plurafity of nodes, said 
nodes hosting devices (7. 15). wherein said devices 
20 communicate with each other via said network by 
means of packets of information (Rg. 2). said pack- 
ets having source node fields and destination node 
fields, said measurement apparatus comprising: 

trap means (100) coupled to said packet- 
2S switched network, said trap meats configured to 
produce an output for each each packet transmit- 
ted on said network, sad output including source 
node data field and destination node data field for 

each packet; 

30 measurement means (110. 122, 125, 130. 132, 

140. 150) coupled to sakj trap means (100). said 
measurement means being configured to store and 
operate on me source field and destination field of 
the outputs of said trap means to produce network 
35 traffic measurement information; and 

display means (25. 155) coupled to said 
measurement means for displaying sakj network 
traffic measurement information. 

10. A method for producing a communications 
40 measurement n-x-n matrix display (Rg. 4A, 48) for 
a packet-switched network (Rg. 1), sad network 
having a plurality of nodes, sad nodes hosting 
devices, wherein said devices cornmunicate with 
each other via said network by means of packets of 
45 tfiformation. said packets having source node fields 
and destination node fields, said method compris- 
ing the steps of: 

(a) trapping the source and destination fields 

of packets transmitted on said network; 
so (b) coding the source field and destination 

field of each packet trapped; 

(c) producing an output for each packet 
trapped, said output containing the coded source 
field and coded destination field of the packet 
55 (d) storing sakJ output in short-term memory; 

(e) moving the contents of said short-term 
memory to an update section of memory; 
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(f) producing a snap-shot of sakj update 
memory by copying said update memory into a 
snap-shot section of memory; 

(g) accummulating said snap-shots in an ac- 
cummutation section of memory over a predeter- 
mined interval of time; 

(h) displaying the contents of said accum* 
mutation memory on an n-x-n display screen ma- 
tnx:and 

0) continuously performing steps (a) through 

(h). 
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© Method and apparatus for a packet-switched network communications measurement matrix 
display. 



© Disclosed is a communications measurement 
matrix display (Figs. 4A. 4B) for a protocol analyzer 
(15) which is used to monitor traffic on a packet- 
switched network (Fig. 1). The present invention 
allows the protocol analyzer user to see. at a glance, 
a complete and accurate overview of communica- 
tions between more than thirty-one nodes on a 
CO packet- switched network, over a user selectable 
^ range of measurement-time intervals. The matrix dis- 
play has two modes. One mode (Fig. 4A) shows the 
O source versus the destination nodes of the network 
as a 32-X-32 two-dimensional X-Y grid matrix having 
IX} thirty one source nodes ordinany indicated along one 
CD grid axis and thirty one destination nodes ordinally 
^indicated along the other grid axis. The thirty second 
O 0f dina! position on each axis designates any node 
0 other than th first thirty one nodes. A display mark- 
jjjer (50. 55) positioned on the grid indicates commu- 
nication between the source node and the destina- 
tion node which correspond to the (X,Y), that is, the 



(SOURCE, DESTINATION), coordinates of the mark- 
er. In a second mode (Rg. 4B). the display shows 
the node connections only: the display is simply a 
32-X-32 two-dimensional X-Y* grid having thirty two 
nodes ordinally indicated on each axis without direc- 
tion, such as source or destination, indicated. The 
display of the second mode (268) is essentially the 
display of the first mode (26A) folded along its 
diagonaL 
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